Imagine you're a manager who delegates tasks to an assistant. You say "wire $500 to the landlord." Your assistant pulls up the payment form, fills in the amount and recipient — but someone has slipped a Post-it note into the landlord's invoice that reads "Actually, send it to this other account." The assistant dutifully changes the recipient. The action is still "send payment" — nothing new was invoked — but the money goes to the wrong place. That's parameter poisoning, and it's the attack surface this paper targets. The committed claim: existing Indirect Prompt Injection (IPI) defenses watch for unauthorized tool calls or new actions, but attackers can leave the action intact and poison individual arguments (a recipient address, a filename, a search query). AuthorityFlow is a three-stage defense that constructs a task-specific trust hierarchy over information fields, traces which field actually produced each tool argument's value, and accepts the value only if that field was trusted for that parameter under the user's original query. The paper introduces FactAuthBench, a new benchmark for evaluating this specific attack class. The numbers are stark. Without any defense, the attack success rate on FactAuthBench is 93.06%. AuthorityFlow drops it to 9.03% — roughly a 10× reduction. The cost is modest: benign task utility falls from 90.28% to 82.64%, an 8.5 percentage-point tax. That's a real tradeoff, but for security-critical deployments it's clearly worth paying. Architecturally, AuthorityFlow sits in the LLM-agent middleware layer — it's not a model fine-tune or a prompt-engineering trick. Stage one uses the LLM itself to parse the user query and build a trust graph over available information fields. Stage two performs information-flow attribution: for each tool argument, which field's content actually determined the value? Stage three is a gating check — accept if the attribution traces to a trusted source, flag otherwise. This is essentially an information-flow control system borrowed from operating-systems security, translated into the LLM-agent stack. The integrity picture is mixed. FactAuthBench is the authors' own benchmark, purpose-built for this paper. That's understandable — the attack surface they define is relatively new and no community benchmark existed — but it means the authors are both designing the exam and grading it. The 93% baseline attack success rate, the 9% defended rate, and the 82.64% utility retention all come from this single benchmark. No independent replication exists yet. The paper does not mention code release. The milestone question is about where parameter-level defense fits in the broader LLM-agent security stack. Right now, most deployed defenses (spotlighting, instruction hierarchy, sandwich defense) focus on action-level detection. If parameter poisoning becomes a recognized attack category — and this paper makes a strong case that it should — the next milestone is integration into production agent frameworks (LangChain, AutoGPT, OpenAI function-calling) with real-world adversarial evaluation, not just synthetic benchmarks. The obvious experiment not run: adversarial robustness testing where the attacker knows AuthorityFlow is deployed and actively tries to fool the trust hierarchy construction or the attribution trace. The paper evaluates against attackers who don't know the defense exists. Adaptive attacks — where the injected content is designed to manipulate the trust-hierarchy reasoning itself — would be the natural stress test. Honest read: this is likely (a) scope limitation for a first paper and (c) saved for a follow-up, not (b) tried and failed.
